HMAC Generator

Hash & Crypto

Generate HMAC signatures with SHA-256, SHA-512, and MD5

Secret Key

Algorithm

Message

HMAC-SHA-256 Signature

How to Use This Tool

Enter your text

Type or paste the string or data you want to hash into the input field.

Choose algorithm

Select the hashing algorithm you need (MD5, SHA-1, SHA-256, etc.) from the options provided.

Copy the hash

The hash is computed instantly in your browser. Click Copy to grab it for use in your application or verification workflow.

Compare hashes

Use the comparison feature (if available) to verify that two inputs produce the same hash.

About This Tool

HMAC Generator is a free, instant, browser-based tool that generate hmac signatures with sha-256, sha-512, and md5. Cryptographic hash functions take an input of any size and produce a fixed-length output (the hash or digest) that is unique to that input. Even a tiny change to the input — a single character — produces a completely different hash. This property makes hashing essential for data integrity verification, password storage, digital signatures, and checksums.

This tool computes hashes entirely in your browser using the Web Crypto API and other standard browser APIs. Your data never leaves your computer.

Common use cases include verifying the integrity of downloaded files by comparing their SHA-256 hash against a published checksum, securely storing passwords by hashing them before writing to a database, generating HMAC signatures for API authentication, creating unique identifiers from content (content-addressable storage), and detecting duplicate files or database records.

Note that MD5 and SHA-1 are considered cryptographically broken and should not be used for security-sensitive applications. For password hashing, use bcrypt, scrypt, or Argon2 rather than raw SHA hashes, as these are specifically designed to be slow and resistant to brute-force attacks. For general-purpose integrity checking, SHA-256 or SHA-3 are the current standards.

HMAC Generator creates keyed-hash message authentication codes for verifying both the integrity and authenticity of API requests, webhook payloads, and data transmissions. HMAC is the standard mechanism for API request signing used by AWS, Stripe, GitHub, and many others.

Why Use This Tool?

Common pitfalls and gotchas

The mistakes that come up repeatedly when working with hash & crypto tools — most of them invisible until they cause production failures or silent data corruption.

Using MD5 or SHA-1 for security
MD5 and SHA-1 are cryptographically broken — collisions can be generated in seconds. They're fine for non-security checksums (file integrity in trusted contexts), but using them for password hashing, digital signatures, or anti-tamper protection is a known vulnerability. Use SHA-256 or SHA-3 for security-sensitive applications.
Hashing passwords with raw SHA-256
Even SHA-256 is unsuitable for password storage — it's designed to be fast, which is exactly what a brute-force attacker wants. Use bcrypt, scrypt, or Argon2, all of which are designed to be deliberately slow and tunable. The cost factor lets you increase work as hardware speeds up over time.
Comparing hashes with `==` instead of constant-time comparison
Comparing hash values with the standard equality operator can leak timing information — attackers can infer how many leading bytes match by measuring response time. Use a constant-time comparison function (`crypto.timingSafeEqual` in Node, `hmac.compare_digest` in Python) for any security-related hash check.

Frequently asked questions

Which hash algorithm should I use?

For file integrity and general checksums: SHA-256 or SHA-3-256. For password storage: bcrypt, scrypt, or Argon2 (NOT raw SHA hashes). For HMAC API authentication: HMAC-SHA-256. Avoid MD5 and SHA-1 for any security-sensitive purpose — they're considered cryptographically broken.

Why does the same input always produce the same hash?

That's the defining property of a hash function — deterministic output. It's what makes hashing useful for integrity checks: anyone hashing the same input gets the same output, and any change to the input produces a wildly different hash. For unique-output applications, you typically combine the input with a random salt before hashing.

Can I reverse a hash to get the original input?

Cryptographic hashes are one-way — you cannot derive the input from the hash. Brute-force or dictionary attacks can sometimes find inputs that produce a target hash, which is why password hashing uses slow algorithms (bcrypt, Argon2) and salts. For non-security uses (deduplication, indexing), the one-way property is fine.

What is a salt and why does it matter?

A salt is random data combined with the input before hashing, ensuring that two users with the same password get different stored hashes. This defeats rainbow-table attacks and prevents an attacker from learning that two accounts share a password. bcrypt, scrypt, and Argon2 generate and store salts automatically.

Related Tools

MD5 Hash Generator

Generate MD5 hash of any text or string

SHA-1 Hash Generator

Generate SHA-1 hash of any text or string

SHA-256 Hash Generator

Generate SHA-256 hash of any text or string

SHA-512 Hash Generator

Generate SHA-512 hash of any text or string

Bcrypt Hash Generator

Hash passwords with bcrypt and verify bcrypt hashes

Hash Identifier

Identify the type of a given hash string